CVE-2008-3909
djangoproject django: no CVSS score yet. EPSS 0.9% chance of exploitation in the next 30 days. Fixed in django 0.91.3, 0.95.4, 0.96.3.
The administration application in Django 0.91, 0.95, and 0.96 stores unauthenticated HTTP POST requests and processes them after successful authentication occurs, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks and delete or modify data via unspecified requests.
- EPSS
- 0.9% chance of exploitation in the next 30 days; higher than 60% of CVEs (scores of 2026-10-31)
- CWE
- CWE-352
- Published
- Modified
- Record from
- the NVD, synced
Affected
- djangoproject:django
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-r5cj-wv24-92p5 | PyPI | django | >=0.91.0 <0.91.3 | 0.91.3 |
| GHSA-r5cj-wv24-92p5 | PyPI | django | >=0.95.0 <0.95.4 | 0.95.4 |
| GHSA-r5cj-wv24-92p5 | PyPI | django | >=0.96.0 <0.96.3 | 0.96.3 |
| PYSEC-2008-2 | PyPI | django | <1.1 | 1.1 |